{"record":{"id":"864ad52f90a693f3","repo":"symfony/routing","slug":"cannot-unserialize-symfony-component-routing-route","errorCode":null,"errorMessage":"Cannot unserialize Symfony\\Component\\Routing\\Route","messagePattern":"Cannot unserialize Symfony\\\\Component\\\\Routing\\\\Route","errorType":"exception","errorClass":"BadMethodCallException","httpStatus":null,"severity":"warning","filePath":"Route.php","lineNumber":82,"sourceCode":"            'path' => $this->path,\n            'host' => $this->host,\n            'defaults' => $this->defaults,\n            'requirements' => $this->requirements,\n            'options' => $this->options,\n            'schemes' => $this->schemes,\n            'methods' => $this->methods,\n            'condition' => $this->condition,\n            'compiled' => $this->compiled,\n        ];\n    }\n\n    public function __unserialize(array $data): void\n    {\n        if (($data['path'] ?? null) instanceof \\Stringable\n            || ($data['host'] ?? null) instanceof \\Stringable\n            || ($data['condition'] ?? null) instanceof \\Stringable\n        ) {\n            throw new \\BadMethodCallException('Cannot unserialize '.self::class);\n        }\n\n        $this->path = $data['path'];\n        $this->host = $data['host'];\n        $this->defaults = $data['defaults'];\n        $this->requirements = $data['requirements'];\n        $this->options = $data['options'];\n        $this->schemes = $data['schemes'];\n        $this->methods = $data['methods'];\n\n        if (isset($data['condition'])) {\n            $this->condition = $data['condition'];\n        }\n        if (isset($data['compiled'])) {\n            $this->compiled = $data['compiled'];\n        }\n    }\n","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/symfony/routing/blob/83fa223250b50f4f018c011e101c330e65ac63cc/Route.php#L64-L100","documentation":"Route::__unserialize() guards against unserializing attacker-crafted payloads: if path, host, or condition come back as Stringable objects, deserialization could trigger arbitrary code via __toString(), so Symfony refuses with this BadMethodCallException. It only fires on malicious or hand-mangled serialized data — legitimate serialized Route objects contain plain strings.","triggerScenarios":"unserialize() called on a crafted/malformed payload representing a Symfony Route where 'path', 'host' or 'condition' entries are objects implementing Stringable; unserializing user-supplied data that was doctored.","commonSituations":"Security-driven: apps that unserialize untrusted input containing Route-like payloads; payload tampering in caches or queues; passing random data to unserialize and hitting this guard.","solutions":["Never unserialize untrusted input; use json_encode/json_decode or a signed serialization format instead","If you must unserialize, validate/allow-list the payload structure and classes first (e.g. allowed_classes: [])","Regenerate the serialized data from a trusted source; do not attempt to hand-craft Route payloads"],"exampleFix":"// before\n$route = unserialize($userInput);\n// after\n$data = json_decode($userInput, true);\n$route = (new Route($data['path'] ?? '/'))->setHost($data['host'] ?? '');","handlingStrategy":"type-guard","validationCode":"$data = unserialize($payload, ['allowed_classes' => false]); if (isset($data['path']) && is_object($data['path'])) { throw new \\RuntimeException('Suspicious Route payload'); }","typeGuard":"function safeRoutePayload(array $data): bool { foreach (['path','host','condition'] as $k) { if (isset($data[$k]) && $data[$k] instanceof \\Stringable) return false; } return true; }","tryCatchPattern":"try { $route = unserialize($payload); } catch (\\BadMethodCallException $e) { if (str_contains($e->getMessage(), 'Cannot unserialize Symfony\\\\Component\\\\Routing\\\\Route')) { /* reject payload, log security event */ } throw $e; }","preventionTips":["Never unserialize user-controlled input","Use allowed_classes => [] in unserialize when class restoration is unnecessary","Switch to JSON for interchange of route data"],"tags":["routing","security","unserialization","symfony"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"83fa223250b50f4f018c011e101c330e65ac63cc","analyzedAt":"2026-09-14T03:19:46.280Z","contentChangedAt":"2026-09-14T03:19:46.280Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}